docs: def _encrypt_data_key(self, data_key, algorithm, encryption_context=None):
          """Encrypts a data key and returns the ciphertext.
  
          :param data_key: Unencrypted data key
          :type data_key: :class:`aws_encryption_sdk.structures.RawDataKey`
              or :class:`aws_encryption_sdk.structures.DataKey`
          :param algorithm: Placeholder to maintain API compatibility with parent
          :param dict encryption_context: Encryption context to pass to KMS
          :returns: Data key containing encrypted data key
          :rtype: aws_encryption_sdk.structures.EncryptedDataKey
          :raises EncryptKeyError: if Master Key is unable to encrypt data key
          """
          kms_params = {"KeyId": self._key_id, "Plaintext": data_key.data_key}
          if encryption_context:
              kms_params["EncryptionContext"] = encryption_context
          if self.config.grant_tokens:
              kms_params["GrantTokens"] = self.config.grant_tokens
          # Catch any boto3 errors and normalize to expected EncryptKeyError
          try:
              response = self.config.client.encrypt(**kms_params)
              ciphertext = response["CiphertextBlob"]
              key_id = response["KeyId"]
          except (ClientError, KeyError):
              error_message = "Master Key {key_id} unable to encrypt data key".format(key_id=self._key_id)
              _LOGGER.exception(error_message)
              raise EncryptKeyError(error_message)
          return EncryptedDataKey(
              key_provider=MasterKeyInfo(provider_id=self.provider_id, key_info=key_id), encrypted_data_key=ciphertext
          )